Recently I have been trying to reverse engineer an IoT malware called NyaDrop using IDA. There I came across this mysterious assignment a few times. addiu $zero, 0xA as well as move $at, $at

Both instructions seem to be just redundant but I feel like they are there for a reason. Does anyone have any idea what that reason is? My guess is that is trying to avoid an emulated MIPS perhaps? Because it would error on an emulated MIPS but will just be discarded in a real one. Not sure, however.

Here is a snippet from the disassembly of nyaDrop that is particularly confusing.

addiu   $zero, 0xA
move    $at, $at
move    $at, $at
//end of malware

  • 1
    Are you sure that it is code and not data ?
    – w s
    Apr 25, 2020 at 6:13
  • Well it does try to execute it, so it is probably code. Moreover, the malware starts off with addiu $zero, 0xA. Apr 25, 2020 at 21:04

1 Answer 1


You can write values to the $zero register, it will simply remain zero.

These 3 instructions are NOPs.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.